hey there everyone my name is michel contrer lead strategic advisor at aina and partners while my job these days is usually to consult businesses about servicenow best practices and strategies i like to go back to my roots and still play around with the technical affinities of the platform that said i had now two weeks since the official release of the new agent klein collector and in this video i'd like to take you along the ride so grab a cup of coffee lean back and welcome to the lab the setup for this lab on agent-based discovery is very simple one linux server running a mid-server instance and one windows server 2019 running an agent client collector short acc let's first have a look at the mid server the reason why i have chosen a linux of a windows server is just to highlight the fact that with the acc it does not matter anymore some of you might already know that for the now traditional agentless discovery you need a windows based mid server in order to talk to other windows devices simply put linux does not speak powershell as the acc is now executing commands on and the endpoints directly the purpose of the mid server in this in this scenario has shifted towards a middleware enabling the bi-directional communication between the acc and the given servicenow instance once the mid server instance is running properly connected to the given servicenow instance and validated we want to set up the acc listener the only thing that you need to provide at this stage is a port for this lab i have chosen port 8097 disclaimer you want always to consult with the responsible stakeholders and teams within your organization about the most fitting configuration we will also cover possible architectural approaches in a bit to get a better understanding of this but now back to the topic once confirmed the setup will create a mid web server the mid web server is exposing a web hook using secure websocket short wss for connections on the provided port you can always navigate to agent client collector mid web server in order to see and update the webhook parameters of any connected mid server furthermore you can navigate to websocket endpoint where you will find the endpoint url this field will provide you with the full web hook url that you have to provide to the acc during setup what is also noteworthy on this screen is the accessible ip address field for external public networks this is particularly interesting for any devices residing outside of the trusted network example an employee's laptop why do you ask well it's time to cover possible architectures first and then let's come back to the screen disclaimer first you would always want to consult with the responsible stakeholders and teams within your organization about the most fitting architectural setup nevertheless the following high-level depictions should give you a very good understanding when it comes to discussing the subject with them the first figure shows devices with acc installed that are located within a trusted network they communicate with the mid server through an internal private ip address firewalls need to be configured to allow wss communication through the given port in the next scenario we have devices outside the trusted network such as an employee's laptop that are connected to your organization's vpn the acc will use the vpn tunnel to connect to the mid server residing in your trusted network similar to the previous scenario firewalls need to be configured to allow wss communication through the given port the downside of this setup is that you need to make sure that the device outside your trusted network are always connecting to the vpn when online it's not necessarily a show stopper but a dependency last but not least you have the option to make the mid web server publicly accessible just like a regular web server evidently this mits web server should reside within a dmz of your organization's network to under no circumstances exposed mid servers residing in your trusted network that that be a huge security hole right in your front door now let's get back to the accessible ip address field on the websocket endpoint form the mid web server for this lab has been set up with a public ip address which can now be used to update this field updating the form does not change any configuration however the endpoint url field provides us now with the full webhook url for acc's residing outside the trusted network the internal web hook remains operational furthermore you can also use a domain name just like we did for our lab next up the acc client deployed on windows server 2019 as you can see it is running as a service the installation process is rather simple i just followed the instructions provided by servicenow you also have the option to use a software distribution solution to deploy the acc on a larger scale consult the available documentation and again make sure to involve the responsible stakeholders and teams of your organization to discuss the configuration of the acc clients looking at the contained config folder we can see that the agent client collector is configured with a yaml file you can also automate the distribution of this file and thus orchestrate the configuration of your acc clients out there the other interesting file is the checkallowlist.json containing all the allowed commands for execution simply put if you try to run for example powershell.exe write host host name without defining it here the execution of the command will fail on a side note you can also allow the execution of all powersheld.exe commands by not defining arguments i have done this with os query which we need for the later acc-spoke demonstration obviously you want to define the allow list properly again involve the responsible stakeholders and teams of your organization the cage folder is where the actual magic happens this this folder contains all the plugins in other words the scripts that are available to the acc for execution let me demonstrate this with the out of the box script that returns serial numbers i can use dash h to see how i can use the script in this case minus d is the most important parameter to provide because we need the parent cage directory for it to work so let's try and do this there we go we received now all the serial numbers that are available on this virtual machine let us now head into the instance and have a look at the acc plugin list you will find that this list corresponds to the modules in the cage folder attached to these plugin records are also packages that the acc will download when needed so when does the acc download the plugin well this depends on the check definition for example here enhanced discovery is going to use the following plugins and then it also depends on the policy itself because the policy will define which check to run so simply put the policy determines which check to run and the check determines which plugin to use now some of you might immediately recognize the potential here the agent client collector is extensible by third parties meaning anyone can write ruby scripts and package them we could potentially see that either partners develop developing acc tool sets and selling them through the servicenow store or independent developers providing decorations in form of update sets this at least for me is super exciting and looks like a very promising future let's see what the community will create with this at their disposal however for now let's stay a bit more basic and have a look at the other provided accv feature allowing automation and orchestration i am talking about the acc spoke the acc spoke is a separate scoped application extending the flow designer with flows and actions to automate anything involving the agent client collector the most enticing action next to the run command action is to run os query on agent action os query comes out of the box with every acc installation and will allow you to run basic sql commands against its host simply put os query allows you to read a device's configuration query is open source and well documented for this lab i headed over to their website osquery.io and copied the first best sql command that i couldn't find to demonstrate this i have created a very simple flow i'm running my run os query on agent action against my test agent and here is the sql command that i am executing once this returns with success the response will be locked into the system log but first let me demonstrate the os query on the windows server 2019. therefore i'm heading into the cage folder i'm opening the os query folder i'm opening my command let's copy this over and head right into it there we go and i can now run the os query i access and into this i can copy my sql commands don't forget this and as you can see it works so now let's do this in the instance we take our flow with the action that we that i have defined and let's hit test run test and it has completed looking at the output we receive in json format the exact same information that i have just received by executing the command on the windows host itself well this brings me already to the end of this video as you can see great times lie ahead but also great responsibility deploying acc on a larger scale is technically and strategically challenging best practice and governance are a must-have so if you have any questions or you need assistance please do not hesitate to reach out to us i'll put contact details into the description that said i hope you liked this video and if you did please leave a like do also subscribe for more and we would really appreciate if you leave us a comment down below thanks for watching see you next time [Music]